CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:openshift_ai. Show all products

80 CVEs, showing 51 to 80PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-48710
Known exploited
Medium 6.5Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Assigned by GitHub_M
May 26, 2026
CVE-2026-42015Medium 5.3Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling
Assigned by redhat
May 26, 2026
CVE-2026-42013High 8.2Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
Assigned by redhat
May 26, 2026
CVE-2026-42012High 7.1Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans
Assigned by redhat
May 26, 2026
CVE-2026-5260High 8.2Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
Assigned by redhat
May 26, 2026
CVE-2026-48864High 7.8Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data
Assigned by redhat
May 26, 2026
CVE-2026-47102High 8.8LiteLLM < 1.83.10 Privilege Escalation via User Update
Assigned by VulnCheck
May 21, 2026
CVE-2026-47101High 8.8LiteLLM < 1.83.14 Privilege Escalation via API Key Generation
Assigned by VulnCheck
May 21, 2026
CVE-2026-42009High 7.5Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
Assigned by redhat
May 18, 2026
CVE-2026-42208
Known exploited
Critical 9.3LiteLLM: SQL injection in Proxy API key verification
Assigned by GitHub_M
May 8, 2026
CVE-2026-42271
Known exploited
High 8.7LiteLLM: Authenticated command execution via MCP stdio test endpoints
Assigned by GitHub_M
May 8, 2026
CVE-2026-42011High 7.4Gnutls: gnutls: security bypass due to incorrect name constraint handling
Assigned by redhat
May 7, 2026
CVE-2026-42010High 7.1Gnutls: gnutls: authentication bypass via nul character in username
Assigned by redhat
May 7, 2026
CVE-2026-33846High 7.5Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
Assigned by redhat
May 4, 2026
CVE-2026-33845High 7.5Gnutls: gnutls: denial of service via dtls zero-length fragment
Assigned by redhat
Apr 30, 2026
CVE-2026-3833Medium 6.5Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
Assigned by redhat
Apr 30, 2026
CVE-2026-1462High 7.8A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `s…Apr 13, 2026
CVE-2026-5483Critical 9.9A flaw was found in odh-dashboard in Red Hat Openshift AI.Apr 10, 2026
CVE-2026-4878Medium 6.7Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
Assigned by redhat
Apr 9, 2026
CVE-2026-4800High 8.1lodash vulnerable to Code Injection via `_.template` imports key names
Assigned by openjs
Mar 31, 2026
CVE-2025-12805High 8.1A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator.Mar 26, 2026
CVE-2026-32981High 7.5Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
Assigned by VulnCheck
Mar 17, 2026
CVE-2025-13465Medium 6.9Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Assigned by openjs
Jan 21, 2026
CVE-2025-14512Medium 6.5Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
Assigned by redhat
Dec 11, 2025
CVE-2025-14087Medium 5.6Glib: glib: buffer underflow in gvariant parser leads to heap corruption
Assigned by redhat
Dec 10, 2025
CVE-2025-12103Medium 5.0Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace
Assigned by redhat
Oct 28, 2025
CVE-2025-6193Medium 5.9Trustyai-explainability: command injection via lmevaljob cr
Assigned by redhat
Jun 20, 2025
CVE-2025-6170Low 2.5Libxml2: stack buffer overflow in xmllint interactive shell command handling
Assigned by redhat
Jun 16, 2025
CVE-2024-11831Medium 5.4Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
Assigned by redhat
Feb 10, 2025
CVE-2024-10963High 7.4Pam: improper hostname interpretation in pam_access leads to access control bypass
Assigned by redhat
Nov 7, 2024
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.